WordPress security plugin
It blocks attacks, checks the site on its own and says in plain words when something needs attention.
Most WordPress sites are compromised through an out-of-date plugin, or one carrying a flaw. And once those flaws are disclosed, automated attacks arrive within hours.
Each of our modules adds a different layer of security, and is switched on according to what you need.
Cuts off anything arriving with bad intent before it reaches the site.
Finds what already got in, even when it left no file behind.
Closes WordPress's back doors.
Defines who gets in, and keeps a record of what happened.
Alerts on newly disclosed flaws.
After purchase, an email arrives with the plugin. You install it from Plugins → Add New → Upload Plugin. It requires WordPress 6.2 or later and PHP 8.0 or later.
Once installed, it asks for your licence key, which you'll find in the email. Once activated, protection starts working right away.
Every module has its own switch to turn it on when it's needed, with a short explanation of what it does.
Updates show up under Plugins and install in one click, or on their own if automatic updates are switched on.
1 site
$39.99 USD per year
33% less than paying monthly
20 sites
$199.99 USD per year
44% less than paying monthly
Unlimited sites
$299.99 USD per year
58% less than paying monthly
Prices in US dollars. 14-day money-back guarantee. Licences cover standalone installations; WordPress multisite networks are not supported in this version.
Scans run on their own, in the background, never while a visitor is loading a page.
Thirteen modules grouped by what they do. Prevention: filters malicious traffic, blocks bots and checks content as it is published. Detection: compares files against the originals and looks for injected code in files and in the database. Hardening: applies server rules, hides the WordPress version and allows the login address to be changed. Control: IP lists, comments and a history of every check. Checks: flags newly published flaws in plugins and themes.
Yes, though running two traffic filters at once makes little sense. If a large one is already installed, what this adds most is the alert on newly disclosed flaws and the database scan.
Host antivirus looks at files. A good part of what this plugin looks for lives in the database, where that antivirus does not reach: hidden spam, redirects, administrators nobody created, or scheduled tasks added without permission.
No. It installs, activates and starts working. The switches that could break something ship turned off and explain what they do before being enabled.
It reports it in the dashboard and by email, naming the file or plugin involved, with a button to isolate or delete it when that can be done safely. An isolated file is disabled, not deleted, so it can be recovered.
WordPress 6.2 or later and PHP 8.0 or later. It runs on Apache, LiteSpeed and Nginx. It needs nothing special from the host: it runs no system programs and asks for no unusual permissions. It is PHP, like WordPress.
No. This version does not support multisite networks. It can be installed separately on as many standalone installations as the licence covers.
We keep none of your information on servers of our own. For the licence, Freemius — the service that handles sales and updates — receives your site's address and the email of whoever activates it. Never your visitors, your content or your security logs: scans run inside your WordPress and their results stay there.
Like any plugin: when a new version is out it shows up under Plugins and installs in one click, or on its own if WordPress automatic updates are switched on.
The plugin keeps working and protecting the site with everything it has. What stops are new versions and support, until it is renewed. Annual and monthly licences renew on their own; the one-off licence never expires.
Yes, 14 days. If something expected is missing, it does not work as expected, or there is a problem that cannot be solved — even one caused by another plugin or the host — the money is refunded.
After purchase, an email arrives with the download link and the licence key. It can also be downloaded at any time from the customer account, which also holds the invoices and licence management.
Most hacked sites did not have a sophisticated attack on them. They had an unpatched plugin and nobody watching.
Protect my site